PERSONAL DATA PROCESSING AND PROTECTION POLICY (ESC)

Section 1. Definitions

Personal data: Information in the form of symbols, writings, images, sounds... on electronic environments associated with a specific individual. It includes basic and sensitive personal data.
Basic data: Full name, date of birth, gender, place of residence, contact information, phone number, email, ID card/Citizen ID card/Passport number, tax identification number, social insurance number..., bank account information, payment transaction history.
Technical data: IP address, device type, operating system, browser, language settings, date and time of connection, Cookies, and other technical information recorded when accessing and using ESC's website/apps.
Sensitive data: (Political, religious, health, biometric, sexual life, bank credit data, geolocation data, etc.) according to Article 1.4 of Decree 13/2023. (ESC does not actively collect this unless required by law).
Data subject: Any individual who has used/is using/is preparing to use ESC services and provides personal data to ESC.
Data processing: Any activity that affects data: collection, storage, access, use, sharing, modification, deletion, encryption, transfer, etc.
Data Controller: ESC – the entity that decides the purposes and means of processing personal data.
Data Processor: ESC or authorized parties, which may be subsidiaries or third-party service partners (under contract) hired by ESC to process data on behalf of ESC.
Consent of the data subject: The voluntary confirmation by the subject allowing ESC to collect and process personal data for one or more specific purposes.

Section 2. Scope and Subjects of Application

This Policy applies to all individuals and organizations accessing, registering, and using ESC's website and services (domain names, hosting, web design, etc.). Your continued use of ESC services implies that you have read, understood, and accepted the terms of this Policy. This Policy Notice is deemed a Personal Data Processing Notice in accordance with Article 13 of Decree 13/2023, so ESC does not need to perform any separate notification step.
The scope of application includes all personal data of customers collected and processed by ESC during the service provision process (including both domestic and international services). This Policy is an integral part of the contract and service usage agreement between ESC and the Customer.

Section 3. Commitment to Data Protection

ESC is committed to complying with the principles of Legality, Transparency, Purpose Limitation, Data Minimization, Accuracy, Integrity and Confidentiality, Accountability, and Data Subject Control. Specifically, ESC only collects and processes data when there is a clear legal basis (contract, consent, law) and solely to serve the notified purposes. ESC maintains appropriate technical and organizational measures to protect data from unauthorized access, loss, or unintended modification. ESC also requires all of its third-party partners and suppliers to commit to confidentiality and compliance with personal data protection regulations.

Section 4. Purposes of Data Control and Processing

You agree that ESC may use your personal data and share the processing results for the following purposes: 1. Service Provision and Maintenance: Creating accounts, configuring, and managing services (domain, hosting, SSL, etc.), identity verification, technical support, and product warranty. 2. Customer Support and Transactions: Sending promotional notices, service renewal information, customer care, and handling complaints. 3. Market Research and Advertising: Conducting surveys, analyzing needs, and recommending suitable products. (Only performed when you have consented to receive marketing information). 4. Safety and Compliance: Preventing fraud, cyberattacks, and network security incidents; preventing illegal acts; performing accounting and tax obligations, and maintaining records in accordance with legal regulations. 5. Other Purposes: Activities necessary for ESC's operations and other purposes with prior notice to you (or as prescribed by law). In case ESC wishes to use personal data for other purposes or beyond the scope of the notification, ESC will actively notify you via email/system and request your consent before proceeding.

Section 5. Types of Data Collected and Processed

ESC may collect and process the following types of personal information:

Basic data: Full name, date of birth, gender, address (permanent residence, temporary residence, contact address), nationality.
Identification information: Identity card number, citizen identity card number, passport number, tax identification number, social insurance number, health insurance card number.
Contact information: Email address, fixed and mobile phone numbers, mailing address (if any).
Account information: Username, password (encrypted), customer ID, user account on the system.
Financial/Payment data: Bank account number, transaction history, invoices for service purchases (if applicable). ESC only retains necessary payment information; payment processing through partners is secured according to standards.
Technical data: IP address, access device (mobile device, computer), operating system, browser, browser language, time and access logs to ESC's website/application, cookie information, and other technical information reflecting cyber activities.
Interaction history: Communication content via email, support tickets, recorded phone calls (if any), or data generated when using voice services/if provided by ESC (where applicable).
Images/Audio: Photos or videos recording users (e.g., CCTV cameras at ESC offices), recorded audio of calls (if any). ESC only collects this data when necessary to ensure security or according to service requirements (clearly stated to the customer). ESC does not collect sensitive data (politics, religion, detailed health info, biometric data) unless separate, explicit consent is obtained from you or as required by law. If ESC needs to collect additional sensitive data (to be notified separately), ESC will request explicit consent from the subject before proceeding.

Section 6. Methods of Data Collection

ESC collects your personal data through:

When you register for services (online or at the office) and fill out information in the registration form.
When you use online services (create an account, log in, place an order) on esc.vn or member.esc.vn.
Automatically recorded when you access ESC's website/application (cookies, system logs).
Interactions via email, phone, survey forms, events, or ESC service channels.
Received from partners authorized by you (for example, payment partners providing transaction results).
From competent State agencies (if any), in cases where ESC is authorized or upon legal request. All sources of data supply are processed by ESC strictly in accordance with the notified purposes and in compliance with the law.

Section 7. Data Retention Period

Your personal data is stored on ESC's system for the period necessary for the collection purposes stated. Typically, ESC retains data at least until the end of the contract/service (e.g., 5 years after contract termination, in line with financial/tax retention regulations), or until you request deletion in prescribed cases (according to Article 16 of Decree 13) and without violating legal regulations. After achieving the storage purpose or upon expiration of the mandatory period, ESC will proceed to delete or anonymize the data safely. ESC complies with the “Storage Limitation” principle of Decree 13/2023.

Section 8. Data Recipients and Data Transfer

ESC only discloses your personal data to: (i) employees of ESC who need access to perform their duties; (ii) subsidiaries and affiliates belonging to ESC; (iii) external service partners and suppliers (who have signed confidentiality agreements with ESC) to serve the purposes in Section 4 (e.g., payment gateway providers, delivery partners, hosting units, technical support software providers). Receiving parties must commit not to use data for wrong purposes, maintain confidentiality, and take responsibility for data security according to regulations.
Overseas Data Transfer: Currently, ESC does not transfer the personal data of Vietnamese customers abroad. If there is a need to transfer in the future (e.g., backup, processing at overseas servers), ESC will comply with Article 25 of Decree 13/2023: only transfer data with the consent of the subject or as permitted by law (such as in a contract), ensure an equivalent level of protection (recognized), and perform reporting/approval procedures with the appropriate regulatory authority.

Section 9. Data Processing in Special Cases

ESC is committed to fully complying with legal regulations when processing data in special cases:

Children's data: Data of children (under 16 years old) is only processed with the permission of parents or guardians. Before processing, ESC will verify the age and require written consent from parents/guardians (according to Article 9.2 of Decree 13). ESC respects privacy and provides special protection for children's data.
Emergency processing: Personal data may be used without consent in emergency cases related to your life or health, or that of others.
Data rights of missing/deceased persons: The processing of personal data of persons declared missing or deceased must obtain the consent of the legal representative in accordance with the law (e.g., heirs, relatives).
Security CCTV: If ESC uses surveillance cameras at the office, images/audio are only used to (i) ensure safety and service quality; (ii) detect violations and crimes; (iii) investigate incidents. All surveillance data is stored for the shortest necessary time and in accordance with surveillance regulations.

Section 10. Rights and Obligations of Customers

10.1. Your Rights: According to Decree 13, you are guaranteed the following rights:

Right to be informed and to consent: To know what data ESC collects, for what purpose, and with whom it is shared. Registering/using ESC services implies that you agree to let ESC process data according to this Policy.
Right of access: Request ESC to confirm and provide a copy of the personal data ESC is processing about you (within 72 hours of a valid request, according to Article 14 of Decree 13).
Right to rectification: Request rectification or supplementation if the recorded data is inaccurate or incomplete, within 72 hours of the request (provided that ESC has collected it).
Right to erasure: Request ESC to delete personal data when the data is no longer necessary for the collection purposes, or if the data is processed illegally, provided that it does not conflict with mandatory retention regulations (e.g., retention under tax laws). ESC will execute the deletion if legal conditions are met.
Right to restriction of processing: In the event of a data dispute or request pending verification, you may request ESC to temporarily restrict data processing.
Right to data portability: Request ESC to provide personal data in a structured, commonly used, and transferable format (if ESC is processing based on consent or contract and regarding data provided by you).
Right to object: You have the right to object to ESC's processing of personal data for direct marketing purposes at any time (ESC will stop sending information upon receiving the request).
Right to withdraw consent: If processing is based on consent, you can withdraw your consent at any time by sending a notice to ESC (via email or in writing). Withdrawal does not affect the lawfulness of data processing prior to that. However, if this directly affects service provision, ESC may restrict certain related services (for example: if consent to store email is withdrawn, renewal notices cannot be sent via email).
Right to complain: If you believe that ESC violates personal data protection regulations, you have the right to complain: first, send a request or feedback to ESC (via email privacy@esc.vn or in writing to ESC's office); simultaneously, you can file a complaint with the Authority of Information Security (Ministry of Information and Communications) or competent authorities. ESC is committed to receiving and resolving complaints quickly and publicly.

10.2. Your Obligations:

When providing personal data of a third party (for example, employee information provided by an organization, or company customer information for ESC to process), you ensure that consent has been obtained from that person (prepare an appropriate contract or agreement).
Follow ESC's instructions on information safety (login, password security, OTP usage). You are solely responsible for securing the accounts and personal information you create (do not share passwords, OTPs).
Promptly update any changes to personal information (address, email, phone number) so that ESC has accurate data.
Refer to and comply with ESC's regulations from time to time (updated on the website), and actively express consent or non-consent when ESC notifies new processing purposes or policy changes.

Section 11. Data Security and Risks

ESC applies a variety of technical and organizational measures to protect personal data:

Technical: All connections are SSL/HTTPS encrypted; firewalls and intrusion detection systems are used; periodic backups are performed; security software is continuously updated; the system is monitored 24/7.
Organizational: Strict access control on the system; employee training on security; maintaining activity logs (audit logs) for inspection; leakage reporting processes. Although maximum efforts are made, absolute security against all threats cannot be guaranteed. Some risks that may be encountered include: hardware failure, sophisticated cyberattacks leading to data loss, and social engineering phishing causing information disclosure. Upon detecting any security incident (e.g., cyberattacks, data leaks), ESC will notify the Department of Cybersecurity and High-Tech Crime Prevention (Ministry of Public Security) within 72 hours of detection (according to the violation reporting regulations in Decree 13/2023), and simultaneously notify affected customers to coordinate in handling the consequences. ESC recommends that you also take measures to protect your personal information, such as: using strong passwords, not sharing OTP codes, logging out of the system when finished, and regularly updating your devices.

Section 12. Cookies and Similar Technologies

When you access ESC's website or application, we may store cookies on your device. Cookies are small data files stored on the browser that help remember choices and collect usage data (e.g., IP, access time, page history). ESC may use the following types of cookies:

Essential cookies: Ensure basic features (shopping cart, login), are set automatically, and do not require consent.
Analytical cookies: (e.g., Google Analytics) collect information about how visitors use the site to improve performance.
Advertising/Interaction cookies: (e.g., Facebook Pixel, Google Ads) used to promote, personalize content, and measure campaigns.

According to current regulations (Decree 13/2023), using cookies to track user behavior constitutes personal data processing, which must comply with the principles of transparency and consent. ESC therefore deploys a cookie consent banner when you first access the site. This banner clearly informs you about cookie usage and allows you to Accept or Decline all non-essential cookies. ESC only activates analytical/advertising cookies after obtaining your consent. You can decline or delete cookies by changing your browser settings; however, disabling essential cookies may prevent some features of the site from functioning fully.

Section 13. Processing Data Without Consent

According to Decree 13/2023, ESC may process your personal data without asking for permission in the following cases:

Protecting the interests of national defense, national security, and public order (requested by competent authorities).
Protecting life and health: emergency or medical rescue cases when the subject is unable to give consent.
Data that has been legally publicized by the data subject (as prescribed).
Performing a contract or preparing steps for signing when you are a participating party.
Public interest and performing duties of competent state agencies (law enforcement obligations) that do not violate the law.
Other cases as prescribed by law (e.g., investigation requirements, state authority supervision).

Section 14. General Terms

1. This Policy takes effect from July 1, 2023. ESC reserves the right to amend and supplement it when necessary. All changes will be updated on ESC's official website and (if necessary) notified via email or the customer management system. Your continued use of the service after a policy change notification implies agreement with the updated content. 2. This Policy is issued based on Article 13 of Decree 13/2023 (notified personal data processing) and current legal regulations (Law on Cybersecurity 2018, Decree 13/2023, etc.). ESC does not require any additional notification procedures other than publishing this document to ensure transparency. 3. If any provision of this Policy is declared invalid by a competent authority, the remaining provisions shall remain in effect. 4. For any questions or complaints related to personal data, please contact:

- Data Protection Agency: ESC Online Solutions Company Limited (ESC).
- Email: privacy@esc.vn (Preferred) or info@esc.vn
- Phone: (024) 39 42 68 96 (HN) / (028) 71 099 199 (HCM)
- Address: (Hanoi) 71 Tran Quoc Toan, Cua Nam Ward; (HCMC) A16 Street 18, Hiep Binh Ward.

Personal data protection